calcom/cal.diy · warning · BadRequestException

Invalid eventTypeId param.

Error message

Invalid eventTypeId param.

What it means

Thrown by EventTypeOwnershipGuard.canActivate when the eventTypeId param cannot be coerced to a positive integer. After confirming the param exists, the guard computes Number(eventTypeIdParam) and rejects it via BadRequestException (HTTP 400) if Number.isInteger is false or the value is <= 0. This catches strings like 'abc', '1.5', '-3', '' after coercion.

Source

Thrown at apps/api/v2/src/modules/event-types/guards/event-type-ownership.guard.ts:32

export class EventTypeOwnershipGuard implements CanActivate {
  constructor(private readonly eventTypesService: EventTypesService_2024_06_14) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest<Request>();
    const user = request.user as ApiAuthGuardUser | undefined;
    const eventTypeIdParam = request.params?.eventTypeId;

    if (!user) {
      throw new ForbiddenException("EventTypeOwnershipGuard - No user associated with the request.");
    }

    if (!eventTypeIdParam) {
      throw new BadRequestException("Missing eventTypeId param.");
    }

    const eventTypeId = Number(eventTypeIdParam);
    if (!Number.isInteger(eventTypeId) || eventTypeId <= 0) {
      throw new BadRequestException("Invalid eventTypeId param.");
    }
    const eventType = await this.eventTypesService.getUserEventType(user.id, eventTypeId);
    if (!eventType) {
      // Mirrors EventTypesService behavior: NotFound when not owned or not present
      throw new NotFoundException(`Event type with id ${eventTypeId} not found`);
    }

    return true;
  }
}

View on GitHub (pinned to 176037d0af)

Solutions

1. Validate the eventTypeId client-side (positive integer regex) before issuing the request.
2. Use the numeric database id from the prior list response rather than any user-supplied text.
3. If accepting slugs is desired, change the guard/service contract explicitly rather than relying on this integer check.

Example fix

// before
fetch(`/event-types/${userInput}`)

// after
const id = Number(userInput);
if (!Number.isInteger(id) || id <= 0) throw new Error('Invalid id');
fetch(`/event-types/${id}`)

const id = Number(request.params.eventTypeId);
if (!Number.isInteger(id) || id <= 0) {
  throw new BadRequestException('Invalid eventTypeId param.');
}

const isPositiveInt = (v: unknown): v is number =>
  typeof v === 'number' && Number.isInteger(v) && v > 0;

When it happens

Trigger: Client sends eventTypeId as a non-numeric string, a float, a negative number, or an empty string in the URL. Examples: /event-types/abc, /event-types/-5, /event-types/12.0, /event-types/.

Common situations: Frontend builds the URL from an untrimmed/free-text input; a UUID or slug accidentally sent where an integer id is expected; trailing slash producing empty param; copy-paste corruption of the id.

Related errors

• Missing eventTypeId param.
• teamId is required for team events, please provide a valid t
• username is required for non-team events, please provide a v
• ApiKeysService -Cannot set both apiKeyDaysValid and apiKeyNe
• EventTypeOwnershipGuard - No user associated with the reques

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/d110b73fce9d3b9b. Report an issue: GitHub.